Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTYRM-0002kP-00 for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Mar 2015 16:16:00 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YTYRL-00069D-Ft for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Mar 2015 16:15:59 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YTYRK-000697-GO for pgsql-hackers@postgreSQL.org; Thu, 05 Mar 2015 16:15:58 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by makus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTYRH-0000EW-OO for pgsql-hackers@postgreSQL.org; Thu, 05 Mar 2015 16:15:56 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 3B0355F7AF; Thu, 5 Mar 2015 11:15:55 -0500 (EST) Date: Thu, 5 Mar 2015 11:15:55 -0500 From: Stephen Frost To: Bruce Momjian Cc: Josh Berkus , PostgreSQL-development Subject: Re: MD5 authentication needs help Message-ID: <20150305161555.GV29780@tamriel.snowman.net> References: <20150304020146.GD24063@momjian.us> <54F7B7C9.1090705@agliodbs.com> <20150305021928.GE24491@momjian.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="wOvCr4+o2vlfoINC" Content-Disposition: inline In-Reply-To: <20150305021928.GE24491@momjian.us> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-45-generic (x86_64) X-Uptime: 11:14:22 up 42 days, 16:03, 6 users, load average: 0.18, 0.20, 0.16 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --wOvCr4+o2vlfoINC Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Bruce Momjian (bruce@momjian.us) wrote: > On Wed, Mar 4, 2015 at 05:56:25PM -0800, Josh Berkus wrote: > > So, are we more worried about attackers getting a copy of pg_authid, or > > sniffing the hash on the wire? >=20 > Both. Stephen is more worried about pg_authid, but I am more worried > about sniffing. I'm also worried about both, but if the admin is worried about sniffing in their environment, they're much more likely to use TLS than to set up client side certificates, kerberos, or some other strong auth mechanism, simply because TLS is pretty darn easy to get working and distros set it up for you by default. Thanks, =09 Stephen --wOvCr4+o2vlfoINC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJU+IE6AAoJEO1sijiDR2RV/WcP/jdRslLSEMuvrRQx3vrk/zB5 w7JBlnwXwdikiRGSWl8ypjmaT2Op4qoMRZ1gHfMzVSGtdjtXT2nksvJTH8RH6Eqc Rc1MSp082EZ4bp43ZtZAiKNoYIyVhcl5Rngy1axC7uPKwZ3VQUKokcDHkpVGHgx/ EDpAumo9fquLXTrz1213axKTG4fPfMvwH+O9PjavUVTtPWU9uLNlkK2lz3lXktGd SabBcEVaWe4QinbNwWPyD0gNOT9YNquZwckx2yUirARe+dMmiN0kz28Wl2lYH6Ko f0uNyVMxoSlAAilwiRpLMn1X8BLdbHL6YDDQ38VRzeVP6KZ3GqnQpy0rxZq/+niJ MSuDNJSvWskyT5w1yt0uZUZ0CcBuUNysFMWbPGAkfwOQ8GwBQPeBFGjJX+gPGdHX BxoRMNgUTGsrPdxTXtulhF2WBA+7pQTVVHzEPpCDtNVtAxfDMXw7GkgGMnpE5i6r tUxr5hKRX9WR2r9ZSMsMFyVfO3EVdFHiC2RS5+dtnAwgeolDMJWBMkgj74VzsOW8 Bfr2+cMHTsTFl9+CjIWkFP3Ut+t53TFxfhPdXkXapLmkKhXBTE75hv/FJmHG7jhm WvC7AQ+xkoAoiFXzKaarvR8XWcBTmtVszBFyVjYXMqTu4r9KabX8Kd0CHmdiVaXY YiilOyXTIRCylYNbfGyi =Iymn -----END PGP SIGNATURE----- --wOvCr4+o2vlfoINC--